The guy that set this up was trying to restrict terminal service users on the server. He modified the group policy for the domain (there are no OUs) and applied it to everyone. He then went to the properties of the group policy folder under C:\winnt\system32 and DENIED adminstrators access to that folder. By doing this, the administrator account was not affected. The problem with that is when we needed to install a sp4 rollup update, we had to allow the admin rights to that folder. The user rebooted the server before re-applying the deny permission. Now, we are locked out just like a standard TS userThe reason for this is he was installing kaspersky AV and it required the roll up update thats what propigated all this. Unfortunately the system now has very limited features/options/administrative rights. It has the lowest priviledge (while logged in as the admin in normal or safe mode) so you have no access to C, no command prompt, no run, nothing practically. Thoseprivileges need to be restored and I'm drawing a blank Any ideas?

Hi, < He then went to the properties of the group policy folder under C:\winnt\system32 and DENIED adminstrators access to that folder.> I am a bit unclear about this sentence? Could you please tell me what exact file you access? Please understand group policy date is stored in the following locations: Group Policy container Group Policy template The Group Policy container (GPC) is an Active Directory container that contains GPO properties, such as version information, GPO status, and other component settings. The Group Policy template (GPT) is a file system folder that includes policy data specified by .adm files, security settings, script files, and information about applications that are available for installation. The GPT is located in the system volume folder (SysVol) in the domain \Policies sub-folder. By default, administrator has full control permission on folders. If it's not granted the corresponding rights, we can explicitly modify NTFS permission of folder to grand these permissions to administrator account. If anything is unclear, please post back.